Privacy Policy

1. Overview

This Privacy Policy explains how ComplyFlo collects, uses, discloses, stores, and otherwise processes information through the ComplyFlo website, software platform, applications, customer portals, integrations, reports, and related services (collectively, the "Services").

ComplyFlo provides workflow, recordkeeping, and reporting software for environmental and operational use cases, including but not limited to wastewater facilities, municipal solid waste sites, compost sites, haulers, used cooking oil operations, and related industries. This Privacy Policy is intended to be broad enough to cover current and future ComplyFlo offerings.

This Privacy Policy should be read together with the ComplyFlo Terms and Conditions / Terms of Service. SaaS privacy policies typically describe the categories of personal data collected, purposes of use, sharing practices, retention, security, and user rights.

2. Scope

This Privacy Policy applies to:

• –Visitors to the ComplyFlo website.
• –Trial users, subscribers, customers, and authorized users of the Services.
• –Individuals whose information is submitted to the Services by customers or users.
• –Business contacts, support requestors, implementation contacts, and vendor contacts.

This Privacy Policy does not apply to third-party websites, systems, applications, or services that may integrate with or link to the Services. Those third parties have their own privacy practices and policies.

3. Categories of Information Collected

ComplyFlo may collect the following categories of information, depending on how the Services are used:

A. Account and Contact Information

• –Name
• –Business name
• –Job title
• –Email address
• –Phone number
• –Mailing address
• –Username and authentication details

B. Customer-Controlled Operational and Reporting Data

Customers determine what operational, reporting, and recordkeeping information they enter, upload, or connect to the ComplyFlo platform ("Customer Data"). Depending on the customer use of services, ComplyFlo may process operational, reporting, and recordkeeping data submitted by customers, including facility identifiers, permit numbers, transporter identifiers, manifests, waste stream records, environmental measurements, disposal records, route or pickup information, uploaded forms, logs, attachments, and related workflow records.

Customer Data may also include personal information contained in those records, such as names, phone numbers, signatures, email addresses, driver or operator information, and other contact details.

The ComplyFlo platform stores and processes Customer Data to provide the features and services requested by the customer. This automated processing does not, by itself, authorize ComplyFlo personnel to view the customer's account, customer lists, or underlying records.

ComplyFlo personnel may view Customer Data only when an authorized customer representative invites them into the account or expressly grants permission for a specific support, troubleshooting, onboarding, or other assistance request. Any such access is limited to the information and activities necessary for the authorized purpose and the scope and duration of the customer's permission.

C. Billing and Transaction Information

• –Billing contact details
• –Subscription details
• –Payment-related information
• –Invoices and transaction history

D. Usage and Device Information

• –IP address
• –Device type
• –Browser type
• –Operating system
• –Referring URLs
• –Pages viewed
• –App activity
• –Date and time of access
• –Crash logs
• –Diagnostic information
• –Cookies and similar technologies

E. Communications and Support Information

• –Messages sent through contact forms
• –Emails and support requests
• –Chat messages
• –Meeting notes
• –Implementation records
• –Training communications

F. Integration and Third-Party Source Data

If a customer connects third-party tools, ComplyFlo may receive data from those systems, such as SCADA systems, spreadsheets, laboratories, accounting tools, GPS or route systems, cloud storage tools, or other customer-authorized data sources.

G. Email Sign-Ups and Free Resource Downloads

When you sign up for compliance updates or download a free checklist or other resource from our website, we collect your name, email address, the page you signed up from, and whether you asked to receive updates.

We use this information to deliver the resource you requested, to send TCEQ compliance updates, guides, product news, and other ComplyFlo marketing emails, and to follow up about ComplyFlo services. Every marketing email includes a way to unsubscribe, and you can also ask to be removed at any time by emailing info@complyflowaste.com.

4. How Information Is Collected

ComplyFlo may collect information:

• –Directly from users, customers, and website visitors.
• –From customer uploads, forms, imports, and manual entry.
• –Through integrations and APIs authorized by the customer.
• –Automatically through cookies, analytics tools, logs, and similar technologies.
• –From service providers, implementation partners, payment providers, or other third parties acting on the customer's instructions or in connection with the Services.

5. Purposes of Processing

ComplyFlo may use information for the following business and commercial purposes:

• –To provide, maintain, host, secure, and improve the Services.
• –To create and manage accounts and subscriptions.
• –To authenticate users and manage access permissions.
• –To process uploads, records, reports, exports, dashboards, and integrations.
• –To provide customer support, onboarding, implementation, and training.
• –To communicate about accounts, service updates, invoices, security matters, and support issues.
• –To monitor usage, troubleshoot problems, analyze performance, and improve product functionality.
• –To protect against fraud, abuse, unauthorized access, and security incidents.
• –To comply with legal obligations, respond to lawful requests, and enforce agreements.
• –To conduct limited marketing and business development activities, subject to applicable law and user choices, including sending emails to people who sign up for updates or download resources from our website (see Section 3.G).

6. Legal Bases and Texas Privacy Considerations

For customers and users in Texas, ComplyFlo may be subject to the Texas Data Privacy and Security Act (TDPSA) depending on the company's size, activities, and the types of personal data processed. TDPSA generally requires a reasonably accessible privacy notice, data minimization, reasonable security measures, and processes for consumer rights requests, subject to the law's applicability thresholds and exemptions.

ComplyFlo may process personal data when reasonably necessary to provide requested services, operate the business, comply with law, protect security, fulfill contractual obligations, or pursue legitimate business purposes consistent with applicable law.

7. Cookies and Analytics

ComplyFlo may use cookies, pixels, SDKs, local device identifiers, and similar technologies to operate the website and Services, remember preferences, authenticate sessions, improve performance, understand engagement, and support analytics.

We use Google Analytics (GA4), provided by Google LLC, to measure website usage — including pages visited and actions such as demo bookings and contact requests — so we can understand engagement and improve the site. Google processes this data as our analytics provider; see Google's privacy policy for details.

8. How Information Is Shared

Customer Data is shared only as necessary to provide the Services, as expressly directed or authorized by the customer, or as required by applicable law. Automated storage and processing by service providers does not, by itself, authorize ComplyFlo personnel or support contractors to view a customer's account, customer lists, or underlying records. Access for customer assistance requires the customer's invitation or express permission, as described in Section 3.B.

ComplyFlo may share information in the following circumstances:

A. Service Providers and Vendors

ComplyFlo uses service providers to support the Services, including hosting, infrastructure, payment processing, communications, and customer support. These providers receive only the information needed to perform their assigned services on ComplyFlo's behalf.

Customer Data may be stored or automatically processed by hosting and infrastructure providers as necessary to operate the platform. ComplyFlo personnel and support contractors may view Customer Data for support, troubleshooting, onboarding, or other customer assistance only with the customer's invitation or express permission, and only within the scope of that authorization.

B. Customer-Directed Sharing

ComplyFlo may share Customer Data with third-party systems, integrations, consultants, regulators, laboratories, contractors, or other recipients when directed or authorized by an authorized representative of the customer.

C. Business Transactions

ComplyFlo may transfer Customer Data as part of a merger, acquisition, reorganization, or sale of the business or assets that provide the Services. Any recipient must be subject to confidentiality obligations and continue to protect Customer Data consistent with this Privacy Policy and applicable customer agreements.

ComplyFlo will not provide prospective buyers, investors, or lenders with access to identifiable customer lists or underlying Customer Data for transaction evaluation without the customer's express authorization. Where practical, ComplyFlo will use aggregated or de-identified information for that purpose.

A business transaction does not, by itself, authorize personnel of ComplyFlo or a successor provider to view Customer Data for customer assistance without the customer's invitation or express permission.

D. Legal Requirements

ComplyFlo may disclose Customer Data without the customer's permission only to the extent required by applicable law or legally binding process, such as a valid subpoena or court order. A voluntary request from a third party or government agency does not, by itself, authorize disclosure of Customer Data.

Where legally permitted, ComplyFlo will notify the affected customer before disclosure so the customer has an opportunity to seek appropriate protection. If advance notice is prohibited, ComplyFlo will provide notice afterward when legally permitted.

ComplyFlo will limit any disclosure to the information required to satisfy the legal obligation. This exception does not authorize routine browsing of customer accounts or use of Customer Data for unrelated business purposes.

E. Affiliates and Advisors

ComplyFlo may share its own business, account, and billing information with affiliates, insurers, auditors, lawyers, accountants, and professional advisors as reasonably necessary for business operations. This provision does not independently authorize access to Customer Data. Any disclosure of Customer Data requires the customer's express authorization unless required by applicable law.

ComplyFlo does not sell personal data, including names and email addresses collected through our website. If ComplyFlo processes personal data for targeted advertising, additional disclosures and opt-out rights may be required under applicable law, including TDPSA.

9. Customer-Controlled Data and Controller / Processor Roles

In many cases, ComplyFlo acts as a service provider, processor, or contractor on behalf of business customers who control the data loaded into the Services. In those cases, the customer may determine the purposes and means of processing certain customer-controlled information, and individuals may need to direct some privacy requests to the relevant customer.

ComplyFlo does not use Customer Data, including a customer's customer lists or contact records, for ComplyFlo's own marketing, sales prospecting, or solicitation purposes.

ComplyFlo may also act as a controller for data relating to its own website visitors, business contacts, account administrators, billing contacts, and product usage analytics, depending on the context.

10. Data Retention

ComplyFlo may retain personal information and customer data for as long as reasonably necessary to provide the Services, maintain business records, support legitimate business operations, comply with contracts, resolve disputes, enforce agreements, protect security, satisfy legal obligations, and retain necessary audit trails.

Retention periods may vary depending on:

• –The type of information.
• –The customer subscription status.
• –Applicable legal, tax, accounting, environmental, or contractual requirements.
• –Backup, archival, and disaster recovery practices.
• –Whether deletion would impair fraud prevention, security, dispute resolution, or audit integrity.

When information is no longer needed, ComplyFlo may delete, aggregate, or de-identify it, subject to legal and operational requirements.

11. Data Security

ComplyFlo uses commercially reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction.

Such measures may include access controls, role-based permissions, encryption in transit, secure authentication, logging, monitoring, backups, vendor management, and incident response processes.

However, no method of transmission or storage is completely secure, and ComplyFlo cannot guarantee absolute security. If you become aware of a security concern related to your account, please contact us immediately at info@complyflowaste.com.

12. International and Cross-Border Data Transfers

ComplyFlo may store or process information in the United States or other jurisdictions where ComplyFlo or its service providers operate.

If ComplyFlo serves users outside the United States in the future, additional disclosures, safeguards, or transfer mechanisms may be required depending on where the data originates and where it is processed.

13. Privacy Rights and Choices

Depending on applicable law and the user's location, individuals may have rights to request access, correction, deletion, portability, or restrictions relating to their personal data, and may have the right to appeal certain privacy decisions. TDPSA requires covered businesses to provide methods for consumers to submit rights requests and to respond within statutory timelines.

To exercise applicable privacy rights, submit a request using the contact information in Section 18 below.

ComplyFlo may need to verify the identity and authority of the requestor before processing a request and may deny or limit requests where permitted by law, including where the data is controlled by a business customer or must be retained for legal, security, or operational reasons.

If applicable law requires recognition of browser-based opt-out signals such as Global Privacy Control, ComplyFlo will honor those signals where those obligations apply.

14. Children's Privacy

The Services are intended for business and operational use and are not directed to children. ComplyFlo does not knowingly collect personal information directly from children in a manner requiring parental consent under applicable law.

If ComplyFlo learns that it has collected personal information from a child in violation of applicable law, ComplyFlo may take steps to delete that information.

15. Public, Regulatory, and Customer Disclosures

ComplyFlo customers may use the Services in industries that involve public reporting, inspections, records requests, regulatory audits, or government submissions. Some information handled through the Services may therefore be disclosed by customers, regulators, or third parties under applicable law, permit rules, subpoenas, open records laws, or other legal processes.

16. Third-Party Services and Links

The Services may contain links to third-party websites, portals, forms, maps, payment pages, or integration partners. ComplyFlo is not responsible for the privacy practices of those third parties.

Users should review the privacy notices of third-party services before providing information to them.

17. Changes to This Privacy Policy

ComplyFlo may update this Privacy Policy from time to time. The revised version will become effective when posted or on the effective date stated in the updated policy.

When we make material changes, we will update the "Last updated" date at the top of this page. Where required by law, ComplyFlo will provide additional notice or obtain consent for material changes.

18. Contact Information

Questions, privacy requests, and privacy complaints should be directed to: